إدارة المخاطر المؤسسية: الإطار والعملية وسجل المخاطر

By MTMS Global · Last updated: 27/10/2026 · Reading time: 8 minutes · Category: Risk Management

Introduction

Every organization manages risk in some way, but the difference between one organization and another is that some manage risk in an organized and recorded manner, while others rely on the experience of individuals who remember what happened before. This article presents the concept, the reference frameworks and then the main implementation tool, the risk register.

The concept of risk and its management

The international standard (ISO 31000:2018) defines risk as the effect of uncertainty on objectives. The effect may be negative or positive, so risk is not limited to threats but includes opportunities. Risk management is the set of coordinated activities to direct and control an organization with regard to risk.

Reference frameworks

The standard (ISO 31000:2018) sets out eight principles, among them that risk management is integrated, structured, customized to the organization’s context, inclusive, dynamic, based on the best available information, takes human and cultural factors into account, and improves continually. The standard divides the framework into leadership and commitment, integration, design, implementation, evaluation and improvement.

The COSO ERM 2017 framework, titled “Enterprise Risk Management: Integrating with Strategy and Performance”, arranges practice in five components: governance and culture; strategy and objective-setting; performance; review and revision; and information, communication and reporting (COSO, 2017). Both frameworks stress linking risk to strategy, which connects to what we explained in our article Strategic management: concept, stages and core models (Arabic).

Classifying risks

Kaplan and Mikes (2012) propose three categories that differ in how they are managed:

The value of the classification is that the strict controls suited to preventable risks can harm strategy risks, because they discourage a willingness to take calculated risks.

The risk management process

In the standard (ISO 31000:2018), the process consists of the following steps:

1. Communication and consultation: involve stakeholders at every step.
2. Establishing the scope, context and criteria: which objectives are exposed to risk, and what level of risk is acceptable.
3. Risk assessment: includes risk identification, analysis and evaluation.
4. Risk treatment: choose the response and implement it.
5. Monitoring and review: measure how effective the responses are and watch for new risks.
6. Recording and reporting: document the results and communicate them to decision-makers.

Treatment options include avoiding the risk, accepting it, reducing its likelihood or its impact, transferring it or sharing it. The choice depends on the level of risk as defined in the criteria and on the cost of treatment.

The risk register

A risk register is the tool that gathers the results of the process into a living document. A common method scores a risk by multiplying the likelihood score by the impact score, each on a scale of 1 to 5, so the score ranges from 1 to 25. What counts as high (for example, 15 or more) and calls for a treatment plan and senior management follow-up is set in advance. The scale here is an example for illustration, and each organization chooses its own criteria according to its context.

An illustrative example

The following example is hypothetical, to illustrate the wording; its figures are not real data from any organization. It assumes a fast-moving consumer goods (FMCG) distribution company.

Common mistakes

• A register prepared once and then filed away: it loses its value if it has no review date.
• Risks with no owner: a risk that everyone shares is one that no one is asked about.
• Vague wording: “weak sales” is not a specific risk; correct wording states the cause, the event and the impact.
• Ignoring opportunities: the standard covers positive effects, not threats alone.
• Separating risk from strategy: risks are managed in isolation from the objectives they threaten.

Conclusion and recommendations

Risk management is a continuous process that links objectives to the uncertainty surrounding them, and the risk register is its practical tool. For those starting out:

1. Define the main objectives first, then ask what could obstruct each one.
2. Adopt a single scale for likelihood and impact and set the threshold for high risks.
3. Assign each risk to one owner.
4. Review the register monthly, and review the scale and thresholds annually.
5. Link strategy risks to the organization’s plan.

Frequently asked questions

What is the definition of risk in the international standard?

The effect of uncertainty on objectives, which may be negative or positive (ISO 31000:2018).

What is the difference between ISO 31000 and COSO ERM?

ISO 31000 is an international standard that provides principles, a framework and a process for risk management, whereas COSO ERM is a framework that links enterprise risk management to strategy and performance in five components. They can be used together according to the organization’s needs.

How do we assess the risk score?

The common method multiplies the likelihood score by the impact score on a scale of 1 to 5, then compares the result with a threshold the organization sets in advance.

How often is the risk register reviewed?

There is no single standard. The common practice is to review it monthly or quarterly, depending on how fast the organization’s environment changes.

Putting it into practice

MTMS Global offers consulting services for building a risk management framework and a risk register, and training programs for management teams. Risk is directly connected to projects, so see our article Project management: phases, knowledge areas and causes of failure. You can also contact us to discuss your organization’s needs.